DEV Community

Lia
Lia

Posted on

How to Uninstall a Self-Hosted WAF and Remove Its Data Directory

#uninstall #directory #proxy #checklist

SafeLine stores its configuration and runtime data in a directory created during setup. The official uninstall procedure is short, but it is destructive: stop the compose project, then delete that directory. This walkthrough uses only the published setup and removal steps so you can identify the path, understand what it holds, and remove it without inventing extra product commands.

SafeLine is a self-hosted web application firewall. Deployed in front of an application, it works as a reverse proxy: clients pass through it before they reach the origin server. It filters, monitors, and blocks malicious HTTP and HTTPS traffic, and it is documented to prevent unauthorized data from leaving the app. Core capabilities listed in the introduction at https://docs.waf.chaitin.com/en/home include defenses for web attacks, proactive bot abused defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. Those controls are tied to the running installation. Deleting the data directory removes the local files for that installation. It does not edit your origin application.

Record the setup path first

The deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy tells you to confirm Linux on x86_64 or arm64, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. Those checks matter at install time. They also explain why the data directory is large enough to hold configuration and database files.

Manual setup, in the same guide, is a numbered directory procedure:

  1. Create the working directory with mkdir -p "/data/safeline". SafeLine writes configuration and data there, and the guide requires at least 5 GB of free disk.
  2. Enter it with cd "/data/safeline" and download the compose file: wget "https://waf.chaitin.com/release/latest/compose.yaml".
  3. Create .env and set SAFELINE_DIR=/data/safeline, IMAGE_TAG=latest, MGT_PORT=9443, a POSTGRES_PASSWORD, SUBNET_PREFIX, IMAGE_PREFIX, ARCH_SUFFIX, RELEASE, REGION, and MGT_PROXY.
  4. Generate DETECTOR_MGMT_TOKEN, MGT_INTERNAL_TOKEN, and DETECTOR_AES_KEY, store them with the documented set_env helper, and run chmod 600 .env.
  5. Create the resource directories, including resources/postgres/data and resources/run, link the socket, and start the stack with docker compose up -d.

The automatic installer in that guide is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en. It does not change the removal rule. You still need the real SafeLine directory before you delete anything. If .env exists, SAFELINE_DIR is the documented place to read that path. Do not assume every host used /data/safeline.

The manual steps also run ln -sfn /data/safeline/resources/run/safeline.sock /var/run/safeline.sock. That link is outside the data directory. The uninstall section never names it.

Remove the instance in the documented order

Use these steps only when you are sure you no longer want SafeLine. The deploy guide's uninstall section is explicit: enter the directory, stop the project, then delete the directory.

  1. Identify <safeline-directory> before you change anything. On a default manual install it is /data/safeline. If you customized setup, use the path in SAFELINE_DIR. Copy the .env secrets only if your own retention policy requires it. The uninstall text does not describe an export command.
  2. Plan how clients will reach the origin. The application guide at https://docs.waf.chaitin.com/en/GetStarted/AddApplication says SafeLine receives traffic for the original site, cleans malicious requests, and forwards the rest upstream. You then resolve the domain to the SafeLine server. After removal, that resolution no longer reaches a running SafeLine listener. Change DNS or other routing in your own process. No cutover command is published.
  3. Enter the directory: cd <safeline-directory>.
  4. Stop SafeLine: docker compose down.
  5. Remove the data directory: rm -rf <safeline-directory>.
  6. Check that the path is gone. Do not run docker compose up -d or docker exec safeline-mgt resetadmin afterward. Those commands start the service and reset the administrator account. They are install and login steps, not cleanup.

Stopping the stack and deleting data are separate. docker compose down does not, by itself, perform the rm -rf step.

Know which files the delete covers

Inside the directory, setup places compose.yaml, .env, and resource paths. .env is restricted with chmod 600 and can contain the Postgres password plus the detector and management tokens. Postgres data is prepared at resources/postgres/data. The sample management port is 9443, and the guide tells you to open https://<safeline-ip>:9443/ after startup. Deleting the directory removes that local console state together with the compose project.

The introduction lists attacks this layer is meant to handle, including SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. Uninstalling the WAF removes that filtering hop. It does not patch the upstream application.

Docker and Docker Compose remain host dependencies. The uninstall section does not tell you to remove them.

Before the final rm -rf, confirm you are not targeting a parent such as /data, confirm you can afford to lose files in that path, and confirm application routing no longer depends on this proxy. Afterward, look at /var/run/safeline.sock yourself. Because the published removal commands never include it, do not treat that symlink as automatically deleted.

Does docker compose down delete the data directory?

No. The deploy guide lists docker compose down and rm -rf <safeline-directory> as separate commands. Run the delete only when you want the configuration, tokens, and local Postgres files in that directory destroyed.

Which directory should I remove if setup was customized?

Remove the SafeLine directory you created, not a guessed default. The manual example is /data/safeline, recorded as SAFELINE_DIR. An install started with manager.sh still has a directory on disk. Read that path from the host before deletion.

Will this procedure uninstall Docker?

No. The documented dependencies are Docker 20.10.14 or newer and Docker Compose 2.0.0 or newer. Uninstall stops the SafeLine compose project and deletes the SafeLine directory. It does not include a Docker removal command.

Do protected applications keep the same path after removal?

The documented model says no. Visitors reach SafeLine by a domain resolved to the SafeLine server, and SafeLine forwards cleaned traffic to the upstream address configured for the application. When the proxy is stopped and its directory is removed, you need another route to the origin. The guides do not publish a migration command for that change.

Is the runtime socket included in rm -rf?

Only if it lives inside the directory you delete. Setup also creates a symlink at /var/run/safeline.sock pointing at resources/run/safeline.sock under the SafeLine directory. The uninstall section does not mention that link. Inspect it after rm -rf and clean it up only as ordinary host maintenance, not as an undocumented SafeLine command.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)